16.113.104.71
Recent Activity
This IP has received recent abuse reports, which causes the score to increase.
- ISP
- Amazon.com, Inc.
- Usage Type
- Data Center/Web Hosting/Transit
- ASN
- AS16509
- Hostname(s)
- ec2-16-113-104-71.ap-south-2.compute.amazonaws.com
- Domain Name
- amazon.com
- Country
- 🇮🇳 India
- City
- Hyderabad, Telangana
Abuse Reports
Total reports
86 from
66 distinct
reporters
First reported
Most recent report
Recent reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
| Reporter | IoA Timestamp (UTC) | Comment | Categories |
|---|---|---|---|
| 🇮🇩 sujak1331 |
Mancing Mania honeypot: attacker detected — 1 distinct trap port(s) touched (ports: 8080; last HTTP(S) at 8080).
|
Web App Attack | |
| 🇬🇧 sandra361 |
Port scan detected: 35 packets across 1 port (8080). | Evidence: REAPER_TARPIT: IN=enp1s0f0 SRC=16.113.104.71 LEN=40 TOS=0x00 PREC=0x00 TTL=55 ID=27739 DF PROTO=TCP SPT=48056 DPT=8080 WINDOW=62727 RES=0x00 ACK FIN URGP=0
|
Port Scan | |
| 🇺🇸 donarev419 |
Connection to port 8080 with data transfer.
Data preview: GET /system_stats HTTP/1.1
Accept-Encoding: identity
Host: 107.175.212.44:8080
User-Agent: jw
Co
|
Port Scan Hacking | |
| 🇺🇸 MPL |
tcp/8080 (2 or more attempts)
|
Port Scan | |
| 🇧🇷 cibersecoptidata |
Port scan / Unsolicited traffic.
|
Port Scan | |
| 🇧🇷 diego |
[probe-168-134] 2026-11-13 23:48:43, Client: 16.113.104.71, Protocol: 6, Unauthorized activity to HTTP: GET /
|
Web App Attack | |
| 🇧🇷 diego |
[arem1] 2026-11-13 22:27:25, Client: 16.113.104.71, Protocol: 6, Unauthorized activity to HTTP: GET /
|
Web App Attack | |
| 🇷🇺 Panamaaa |
Port scan detected; Brute-force attack detected
|
Port Scan Brute-Force | |
| 🇧🇷 diego |
[probe-smbits-188-16] 2026-11-13 21:26:37, Client: 16.113.104.71, Protocol: 6, Unauthorized activity to HTTP: GET /
|
Web App Attack | |
| 🇫🇮 Birdo |
|
Exploited Host Hacking | |
| 🇺🇸 drewf.ink |
[21:34] Redis RDB-persistence-abuse RCE attempt: CONFIG SET dir='/root/.ssh' dbfilename='authorized_keys', then SAVE - captured payload: k='nnssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDwD6shiwZOVRTiRNft26Ik39x+Q1k3dBKD6TaW5xzaTnn'
|
Hacking | |
| 🇩🇪 wupinyin |
Honeypot: tried to load a malicious module into a decoy Redis server (rogue replication master) [1 event, 2026-11-13T21:34:14Z; auto-reported by CrowdSec]
|
Hacking Exploited Host | |
| 🇫🇷 uthul |
T-Pot honeypot: 36 hits on ports [443, 2376, 6379, 8080] (automated)
|
Port Scan Web App Attack | |
| 🇫🇷 uthul |
T-Pot honeypot: 1 hits on ports [6379] (automated)
|
Port Scan | |
| 🇸🇬 drewf.ink |
[21:33] Redis RDB-persistence-abuse RCE attempt: CONFIG SET dir='/root/.ssh' dbfilename='authorized_keys', then SAVE - captured payload: x='"\n\nssh-rsa'; k='nnssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDwD6shiwZOVRTiRNft26Ik39x+Q1k3dBKD6TaW5xzaTnn'
|
Hacking |
Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown